Just going on what vulnerbilities that have been found (and assigned a CVE number) is one thing. The real question should be, how big is the real number of vulnerbilities that have not been found yet.